基于用户标识的OpenStack身份认证协议

OpenStack Authentication Protocol Based on User Identity

摘要: OpenStack是开源云平台管理项目，依靠Keystone组件产生的Token进行身份认证。为了兼顾到OpenStack的安全性和提升认证效率，在已有的UUID token、PKI token、PKIZ token、fernet token认证的基础上本文提出全新的基于用户标识的身份认证，以Keystone为中心将用户身份与权限相结合，利用双因子CPK技术生成唯一密钥，在保证了Token的安全性同时兼顾到认证效率，省去服务节点验证Token的有效性时需要Keystone组件协助的步骤，支持本地验证token，简化了认证流程，提高了身份认证的效率。

Abstract: OpenStack is an open source cloud platform management project that relies on tokens generated by Keystone components for identity authentication. In order to take into account the security of OpenStack and improve the authentication efficiency, based on the existing UUID token, PKI token, PKIZ token, and fernet token authentication, this article proposes a brand new identity authentication based on user identity. The combination of permissions uses the two-factor CPK technology to generate a unique key, which ensures the security of the token while taking into account the authentication efficiency, eliminating the steps that the service node needs to assist with the Keystone component when verifying the validity of the token, supporting local verification of the token, and simplifying the authentication process has been improved, and the efficiency of identity authentication has been improved.